Failed to index audit message from queue – How to solve this Elasticsearch error

Opster Team

Aug-23, Version: 6.8-6.8

Briefly, this error occurs when Elasticsearch is unable to index an audit message from the queue due to issues like insufficient disk space, incorrect index settings, or network connectivity problems. To resolve this, you can check if there’s enough disk space and increase it if necessary. Also, verify the index settings and adjust them appropriately. Lastly, ensure that the network connection between Elasticsearch and the source of the audit messages is stable.

This guide will help you check for common problems that cause the log ” failed to index audit message from queue ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: queue, plugin, index.

Log Context

Log “failed to index audit message from queue” classname is
We extracted the following from Elasticsearch source code for those seeking an in-depth context :

                    logger.debug("index audit queue consumer interrupted"; e);
                } catch (Exception e) {
                    // log the exception and keep going
                    logger.warn("failed to index audit message from queue"; e);